An issue was found with the Luna Cloud HSM Support Tool version 1.0.0 where incorrect data was reported for datacentre connectivity in some cases. 

This issue has been fixed with the Luna Cloud HSM Support Tool version 1.0.2.

Luna Cloud HSM Support Tool version 1.0.2 addresses the following bug: 

• LCH-1498 - Support Tool reports incorrect info due to AuthN Changes.

FW 2.0.2 has been released to all production environments. This release resolves an issue that prevented cloning objects between two Luna Cloud HSM partitions when using the 10.5 client.

The new firmware versions based on region and FIPS mode are as follows: 

• NA FIPS - 2.0.2
• NA non-FIPS - 2.0.2
• EU FIPS - 2.0.2
• EU non-FIPS - 2.0.2

FW 2.0.2 includes the following bug fixes:

• LCH-489 - CPv4 Cloning command permissions incorrect for pre-FW-2.0 partitions.
• DPS-10104 - Luna Cloud HSM Partition Cloning Fails with the 10.5 Client

  Cloning keys between two Luna Cloud HSM partitions fails when using the 10.5 client. There are currently two possible workaround scenarios.
  -> Workaround #1 - If there is a Luna SA7 (or any other separate device to use as an intermediary for the cloning) then clone to and from that device.

  -> Workaround #2 - If there is no separate device then completely uninstall the 10.5 client and install the 10.4 client from scratch. For this option please raise a support ticket to the Thales Customer Support portal to request to join the 2 partitions together as the 10.4 client does not support dynamic partition loading.

The CipherTrust Data Security Platform as a Service (CDSPaaS) is now available for provisioning through Thales Data Protection on Demand.

For more information about CDSPaaS see CipherTrust Data Security Platform Services (CDSPaaS).

For more information about provisioning the service and getting started with CDSPaaS see Get Started with CipherTrust Data Security Platform Services.

The new Universal Client Supported Versions with Luna Cloud HSM policy has been created. This outlines the date of the released Universal Clients and their 'end of support' timelines.

If your Universal Client is found to be no longer supported it is strongly recommended that you upgrade to the latest version at your earliest convenience. 

See Upgrading your Client for more information.

The DPoD Key Broker for Google Cloud EKM service now supports the following Key Access Justification reason codes:

• GOOGLE_RESPONSE_TO_PRODUCTION_ALERT
• MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION

For more information about the service see Key Broker for Google Cloud EKM. For more information about the newly supported codes see Key Access Justification Reason Codes.

Thales Data Protection on Demand has made the following changes to how billing and service subscriptions work in DPoD:

• The trial state no longer applies to the tenant, tenants are instead entitled to a 30-day evaluation period for each unique DPoD service type. The trial begins when you first create a new DPoD service of a service type and deleting the service does not stop or pause the trial.
• The Service Elections submission and approval process remains unchanged, but it now triggers the conversion of trial subscriptions to production subscriptions or directly creates production subscriptions. When a service elections form is processed the selected service types become paid subscriptions.
• Service providers, tenant administrators and application owners can review their subscription data using the Subscriptions tab in the DPoD GUI.
• All services of a new service type provisioned after April 15th are "Trial" subscriptions, with a 30-day evaluation. 

Tenants that have an accepted Service Elections form will have the following changes: 

• All paid subscriptions (DPoD Monthly, DPoD Term, Google) will be visible from the Subscriptions tab in the DPoD GUI.
• All services created before April 15th under a service elections form become "Term" (or "Uncommitted" if the Term is expired) subscriptions.
• All services created before April 15th and not under a service elections form become "Uncommitted" subscriptions.

Tenants that do not have an accepted Service Elections form will have the following changes:

• All existing services become "Trial" subscriptions, beginning April 15th, with a 30-day evaluation. 

Note: If your tenant is unable to retrieve and display subscriptions please contact Thales support to resolve the issue. You will be unable to provision new services until the issue is resolved. 

The Service Provider Tenant Usage Report and the associated tenants/usageReport, tenants/usageDetails, and service_instances/usageDetails endpoints are deprecated and will be removed from the platform by the end of 2023. 

As an alternative use the Service Report in the DPoD service provider tenant or the /v1/service_instances/usageBillingReport endpoint, and the /v1/backoffice/serviceAgreements{tenantId} endpoint to compile tenant usage information.

The CipherTrust Data Security Platform is now visible in EU tenants as a beta service offering. Access to the beta service is restricted at this time. The beta service is disabled in all tenants that are not participating in the beta.

For more information about registering for the CipherTrust Data Security Platform beta please contact steve.kingston@thalesgroup.com.

The enterprise tenant View Services table now includes a Status column. The Status column provides details on the service provisioning state of the service. 

Possible values for Status include:

• Provisioning
• Provisioned
• Provisioning Failed
• Deprovisioning
• Deprovisioning Failed

See the View Services Table for more information.

FW 2.0 has now been FIPS approved. 

The NIST Certificate verifying that FW 2.0 is now FIPS approved can be found in this Cryptographic Module Validation Program link.

The firmware versions for Luna Cloud HSM Services operating in FIPS and non-FIPS NA and EU environments have been updated. The new firmware versions based on region and FIPS mode are as follows:

• NA FIPS - 2.0
• NA non-FIPS - 2.0.1
• EU FIPS - 2.0
• EU non-FIPS - 2.0.1 

In addition to the new releases, FW 2.0.1 also includes the following bug fixes:

• LGX-4120 - Ed25519 was failing with CKR_ECC_UNKNOWN_CURVE. Ed25519 no longer fails with CKR_ECC_UNKNOWN_CURVE.
• LKX-9788 - The DES3-CBC unwrapping mechanism was failing. DES3-CBC no longer fails during unwrapping.